• 0 Posts
  • 35 Comments
Joined 1 year ago
cake
Cake day: August 15th, 2023

help-circle
  • Unforeseen@sh.itjust.workstoSelfhosted@lemmy.worldDNS?
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    1
    ·
    6 days ago

    For Windows it absolutely is in order of listing however. Typical behaviour is no reply after a second against the primary DNS results in it moving down the list.

    Redundancy aside, this is more important when you span multiple datacenters and always want lookups going to the completely local or most local DC available.

    TIL about the Linux/BSD not having preference though. Good to know.

















  • The attack vectors I’m thinking of just come from the inherent complexity and centralization. I’m just considering the amount of damage that can be done with a compromised DA account for example vs a non directory environment.

    It’s complicated. Done right it can be more secure, not done right it’s less secure.

    I also only get brought in for problems for the last however many years, so I’m probaby a bit biased at this point haha.

    I have had to tell companies they are going to have to rebuild thier AD from scratch because they didn’t know what thier DSRM password was (usually after a ransomware attack). These are the sort of hassles I think about vs non AD.